a9106e8cad93054ba781e6f4ce24ad249faa88543f588cb91b7619412b83ef36

Analysis

user interaction
yes
max time kernel
900s
max time network
902s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sonoyuncuclient.exe
Size 13.4MB
Sample260910-b76kestcme
SHA256 a9106e8cad93054ba781e6f4ce24ad249faa88543f588cb91b7619412b83ef36
MD5 ca26ec392453aa3930cc0adf63ad88c2
SHA1 2f4811dac084029df0f98f7891b7f19893cebd75
SHA512 339d3ab5bd6bf389be6a96d32491423b5530d64c756ce8d69712dad7b330225e92d6443c699805811fa8d7d673dc810218e3493c116303eeccfa750802c457cd
SSDEEP 196608:F/zMDnTh+KmZXb/m+u3EzaSx8h1SH+ZDcloII/UIKZBd94u0IkPZwHIONaZel:F/55XjUEzHeh1U+bIbZJnjkx3/ZQ
TLSH
T18AE633B97D613492CC5CBAF50AC63ACA5DFCAE255EC8C148FD5A3069495D808B27CF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sonoyuncuclient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	sonoyuncuclient.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sonoyuncuclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sonoyuncuclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sonoyuncuclient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sonoyuncuclient.exe

Executes dropped EXE 1 IoCs

pid	Process
5460	sonoyuncuclient.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sonoyuncuclient.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sonoyuncuclient.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4868	sonoyuncuclient.exe
5460	sonoyuncuclient.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1944	chrome.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334788178656330"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{7C6A1650-3C37-455D-A8B2-71402C24D317}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{D35B0A1E-9913-4201-8615-A2B6F044342E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5460	sonoyuncuclient.exe
5460	sonoyuncuclient.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
3828	explorer.exe
3828	explorer.exe
5388	chrome.exe
5388	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5460	sonoyuncuclient.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe
Token: SeShutdownPrivilege	4380	chrome.exe
Token: SeCreatePagefilePrivilege	4380	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5460	sonoyuncuclient.exe
5460	sonoyuncuclient.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
1248	sihost.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
5460	sonoyuncuclient.exe
5460	sonoyuncuclient.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
4380	chrome.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5460	sonoyuncuclient.exe
1140	StartMenuExperienceHost.exe
5140	SearchHost.exe
3828	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5460	4868	sonoyuncuclient.exe	89
PID 4380 wrote to memory of 5092	4380	chrome.exe	96
PID 4380 wrote to memory of 1944	4380	chrome.exe	97
PID 4380 wrote to memory of 2476	4380	chrome.exe	98
PID 4380 wrote to memory of 2476	4380	chrome.exe	98
PID 4380 wrote to memory of 4108	4380	chrome.exe	100
PID 4380 wrote to memory of 4108	4380	chrome.exe	100
PID 4380 wrote to memory of 2704	4380	chrome.exe	101
PID 4380 wrote to memory of 2704	4380	chrome.exe	101
PID 4380 wrote to memory of 4976	4380	chrome.exe	102
PID 4380 wrote to memory of 4976	4380	chrome.exe	102
PID 4380 wrote to memory of 3344	4380	chrome.exe	103
PID 4380 wrote to memory of 3344	4380	chrome.exe	103
PID 4380 wrote to memory of 4772	4380	chrome.exe	104
PID 4380 wrote to memory of 4772	4380	chrome.exe	104
PID 4380 wrote to memory of 480	4380	chrome.exe	105
PID 4380 wrote to memory of 2560	4380	chrome.exe	107
PID 4380 wrote to memory of 5252	4380	chrome.exe	108
PID 4380 wrote to memory of 2560	4380	chrome.exe	107
PID 4380 wrote to memory of 5252	4380	chrome.exe	108
PID 4380 wrote to memory of 3992	4380	chrome.exe	109
PID 4380 wrote to memory of 3992	4380	chrome.exe	109
PID 4380 wrote to memory of 2140	4380	chrome.exe	110
PID 4380 wrote to memory of 2140	4380	chrome.exe	110
PID 4380 wrote to memory of 3568	4380	chrome.exe	111
PID 4380 wrote to memory of 3568	4380	chrome.exe	111
PID 4380 wrote to memory of 3140	4380	chrome.exe	115
PID 4380 wrote to memory of 2976	4380	chrome.exe	114
PID 4380 wrote to memory of 3328	4380	chrome.exe	116
PID 4380 wrote to memory of 3140	4380	chrome.exe	115
PID 4380 wrote to memory of 2976	4380	chrome.exe	114
PID 4380 wrote to memory of 3328	4380	chrome.exe	116
PID 4380 wrote to memory of 3340	4380	chrome.exe	117
PID 4380 wrote to memory of 548	4380	chrome.exe	118
PID 4380 wrote to memory of 3340	4380	chrome.exe	117
PID 4380 wrote to memory of 548	4380	chrome.exe	118
PID 4380 wrote to memory of 4036	4380	chrome.exe	119
PID 4380 wrote to memory of 4036	4380	chrome.exe	119
PID 4380 wrote to memory of 4844	4380	chrome.exe	120
PID 4380 wrote to memory of 1584	4380	chrome.exe	121
PID 4380 wrote to memory of 4844	4380	chrome.exe	120
PID 4380 wrote to memory of 1584	4380	chrome.exe	121
PID 4380 wrote to memory of 1136	4380	chrome.exe	122
PID 4380 wrote to memory of 1136	4380	chrome.exe	122
PID 4380 wrote to memory of 2444	4380	chrome.exe	124
PID 4380 wrote to memory of 2444	4380	chrome.exe	124
PID 4380 wrote to memory of 3984	4380	chrome.exe	125
PID 4380 wrote to memory of 3984	4380	chrome.exe	125
PID 4380 wrote to memory of 4900	4380	chrome.exe	126
PID 4380 wrote to memory of 4900	4380	chrome.exe	126
PID 4380 wrote to memory of 5448	4380	chrome.exe	127
PID 4380 wrote to memory of 5448	4380	chrome.exe	127
PID 4380 wrote to memory of 4440	4380	chrome.exe	128
PID 4380 wrote to memory of 4440	4380	chrome.exe	128
PID 4380 wrote to memory of 1256	4380	chrome.exe	129
PID 4380 wrote to memory of 4976	4380	chrome.exe	130
PID 4380 wrote to memory of 2704	4380	chrome.exe	131
PID 1248 wrote to memory of 3828	1248	sihost.exe	136
PID 4380 wrote to memory of 5388	4380	chrome.exe	143
PID 4380 wrote to memory of 3456	4380	chrome.exe	144
PID 4380 wrote to memory of 3456	4380	chrome.exe	144
PID 4380 wrote to memory of 5100	4380	chrome.exe	145
PID 4380 wrote to memory of 5100	4380	chrome.exe	145
PID 4380 wrote to memory of 564	4380	chrome.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\sonoyuncuclient.exe
"C:\Users\Admin\AppData\Local\Temp\sonoyuncuclient.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Roaming\.sonoyuncu\sonoyuncuclient.exe
  "C:\Users\Admin\AppData\Roaming\.sonoyuncu\sonoyuncuclient.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd08d4c728,0x7ffd08d4c734,0x7ffd08d4c740
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,2747985754340739110,9685534552082963581,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1596,i,4622162117845402299,1733282421939762233,262144 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,2158663879637298949,15472624217569758977,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,15331187066066317039,17055429011303527714,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17801883519944894756,11161842085123512085,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4636,i,2486430688294701121,4090234924212288582,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,7252691334188461558,10177957365457409684,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,9024786536666988329,16621238129914794670,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5488,i,975763545752170473,12914659994835500157,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5500,i,10974696780218571875,5925738478915447603,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5688,i,7348861196608337507,2333577098424557882,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5692,i,11392864189743782772,7281800468575149473,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,16211521490221572502,11266768394304270878,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,11192951227587413128,4273053005432382459,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6040,i,9468504913656355904,2213911194134754284,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6648,i,8291708089100939623,15146195874517263325,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5740,i,1646084806844315215,6515975699585955796,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,13518932839100024420,7295471046778114151,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,8695885271530517482,14710955367779080080,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4700,i,4964466497712120580,735420226266666202,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6632,i,16957744722975645630,7612132139203454485,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:9
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5420,i,16471261576944456743,3956751928330088805,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3540,i,140677503744095510,17770497981091401310,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3720,i,13991484067234561192,1013835849228413109,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5696,i,10204839276710211038,13198995214349116550,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4608,i,4254570487084464741,13923394039016438367,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4664,i,12573969234667638080,1072329696090426965,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6056,i,1853424560681386350,17519815611262955612,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6340,i,14501222688711991502,2071469545185561937,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6792,i,14184030783147579799,5238653884836371459,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6020,i,10417876389682277415,8000140271936873450,262144 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5968,i,1376756353807224306,16847816767091807006,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4620,i,8440787915732275036,17270463361905468409,524288 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=4692,i,11801372231793498181,15287406684716347496,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6748,i,9410413316521821552,2773250709068269320,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6820,i,11597709535124433787,3219390659593806614,2097152 --field-trial-handle=1964,i,6746216582197209543,14450781581570944658,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:1804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3828

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1140

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5140

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58930bf3-1380-46fb-af5e-c6027db4821d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\58930bf3-1380-46fb-af5e-c6027db4821d.tmp
Size 12KB
SHA256 2336777e93ceb45c97ac0e5e8238e3f992d0211cc7dac2cf3bb13206abe77cfd
MD5 45ac9907980bfa6aa44eb6a8acc1f19a
SHA1 95be53f7eddc0f206e98e96874411591d908fb9a
SHA512 71a48ee6e778875cdcd2f02eb6ac94aeaad6424620c8c1e9c3af1c81a5dd540c8a53085bf8ec6456358fa75efd8641948fc32126367210184c54579d52aab604
SSDEEP 192:+RPcBzI7QLv7+rAPRp2mfX5G9pHsb+WNy37A4ly2y62O3IuPTVyIsnAUgE:+RPmzIUzvXcTwL/2N2O3z1E
TLSH
T18042C52FB9106A7B9DDBC329F9667B57E2F1202126942EC4E7FC892C10E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 816B
SHA256 8b62b6b867939d687939bab8afca1a660df12a804dc6cbf8ca1841aca8262611
MD5 79298e64648a62d8976dc324688304e6
SHA1 2c31fb49118ad9169a67b8c6326986f55c7410de
SHA512 575a74d8ff7bad142c837dd2893fdd54fc78633583764b722e5e27454aa25c12730cacb183ef59ecc232c3c314dd80e2f971ba98025137622100e0b91954f50f
TLSH
T11001214066938803DB80097A25E60CBE693B42A0185BDFFE84A4E2E645E77B5DC34277
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 689b360821603839bfc8ee3d756c6d2ccd7a968e9505212dec7cbe9c9ca900c5
MD5 a56e65fe001544ce7eda0422270474e9
SHA1 eab63bd3432099a51f2a474a2bfe04961f1a6313
SHA512 bfb9fe9e3e2e0318b35d1f72fcb2085aa9b9cc5110d840881a96c0916396a15119d96a9b957ea35586cc39c81c9fb24d2caa3dc0755c33f085533218bc2e6860
TLSH
T1EF11470062938803DF40097625E6187E593B42A01C4FDFFD44A4D1F995E7779DC34177
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 864B
SHA256 fe63d6134de7b1ae1337c36cd32372ef45cbf5561b38b51c20d7e5ed06e0b1b2
MD5 143f81b4181bdd1e6bff79cd47ffeadd
SHA1 0c8e4e6b81058fa7ea0105fdca47eb7591043002
SHA512 7fc950fc875035a876176f649b120019d1dc73dbe652f06c22efb88227c231f63379bb5601c84d66109c9fd0d2d325edeedf2bc38d88b13f655d9c487d0227d7
TLSH
T113117B4062938803DF40157665E50C7E653742A0184FCFFD44A4D1F950E7776DC74177
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 768B
SHA256 5c63944192557108603fdda2f93da5184b0778e2b2d4c3bc5c0b10b32cdb3776
MD5 cd54376eb40df0c89066f0d9dbd40dd2
SHA1 901489f4e35b242ca328ab69d1eecb26ffd34ac1
SHA512 626e08a6ca4326a93a3627ceffb1df33a3edb334b380a14d366af3b3365dce89de02706cee93fb6e37c34db4350f9801148518a95c1b0698125e8e5709c8972d
TLSH
T1E4017240A5539903CB811A7664E508BF2A3B52B4180FDFFD48A0E1FA84E3BB5ECB4177
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 b28dd3ce18b2e0c937df1232bf85e91ac4346f11265cde86249e44f52f8829a5
MD5 f72eea70f5f3d32e31f3734b7eef3b44
SHA1 a4189542d3bdc21973c0684ecaf2e67ab4cefaea
SHA512 12a8e670add8697c7b8ab2cb80fac70aaf5f451f5fb029fe402cfc66c937d533ecd4e862542bebe0eb2e34b0b7e2da603829619d5b4d6ce4fe3b7cc2f78d1738
TLSH
T17201760062938803DF81097629E50CBEA93B42B0184BCFFD44A0E1F640E377ACC34177
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 01dafc3a6755964b129047f35f12f63636ab4e5a0254188e6294771072178eeb
MD5 4223ace8fd70de6e3534b9075522883d
SHA1 2668d0b5a76a57279f93074f13f74596bef8f478
SHA512 4aee400d1c9050563d0f42b15bbe205e791735565aae4240e9464e55ac30d5337bac48d138a7e9bea91c2f86f579dced16001fef96e4e0c2be6ff1ea8f7cfdec
SSDEEP 192:D0umlttxyByPyQyky5yayQIxlEdlASZqgPNP3aP9fPiyVxyMyByVV8yOovqy3iBF:D0umlttxwM7/y5B3IxlEdlASZqgPNfag
TLSH
T184127EF7C3E8C62D881156F49B156F1ECE290618132C3C67C9D8AE5BE3E3972E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0b7e500c5727898dc590df743559bcf570f299eee62485a76e53cf944e943b75
MD5 9a465cf041a096ee2193a64cf225f246
SHA1 db219b3162c94b858294596e7dc801d2c174df25
SHA512 b6096dc1f299f9043112f579b2d2a6ccd0c0f29dc9e258e58fbd8ed78e189b1ab1172f4d215d72c3f13ab358b00030b5fc5fb83aad173d060715c9fca278ad58
SSDEEP 192:DIp4Il+DyPyfyAyrIxlpglARmlgPNP3aP9fPiyVxyMyByVV8y1ovfymyKysyxyR8:DIp4Il+D+4fgIxlpglARmlgPNfaFfqkb
TLSH
T170125EF7C3D8862D885156F49B152F1FCE290A24532C3C26C9D8EF5BA3E6972E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 12dded7766391ed1a3ca6d63014ca2aa55d94e1588fedafbd4bf323cbfed0594
MD5 21d79cfd777eb826f52fc3e3a5b332ed
SHA1 5b5a1b5c8e69723856477c3500d7e104a72866d1
SHA512 9d9ddfa06e6963a80d26d5c483c00f03bcb48cbb0f3d2ea2459916ec6f0f814c85ceee866215b1647d0ffa8e399b79f7a0374db2f13ac2771538a106e0d4188c
SSDEEP 192:DIp4Il+DyPyfyAy3y5yayQIxlpglARmlgPNP3aP9fPiyVxyMyByVV8y1ovOy3iYW:DIp4Il+D+4f0y5B3IxlpglARmlgPNfa9
TLSH
T1E33280F7C3D8862D885156F49B152F1FCE290A1853283C27C9D9EF5BE3E6872E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 4b3853930050fad7b6fe178b1a00c015271a7bf4886dbe5194b9e47fcf682716
MD5 5917560b380226d16352c65167f8e0e3
SHA1 357b395a8c52a3de143cc9bb2a2072d394ad03c7
SHA512 1203ceeefd72e067da9068c75b7214afb4b3bc0c30b6c20f4fdfd0bebf98b120b382fc9f4fb06eec4b10eb6f46f14f4b60d0261792c28aa0f53d0478945d0375
SSDEEP 192:D0umlttxyPEjyaykyGysy5IxlEdlASZqgPNP3aP9fPiyVxyMyByVV8yOovqySbBe:D0umlttxMEjBjTXiIxlEdlASZqgPNfaL
TLSH
T11C128FF7C3E8C62D881156F49B156F1ECE290624132C3C66C9D8AE5BD3E3972E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 af12fda0d9df82c36f8dfaaf461690975351d76b40ae050aa8fad8a409428ff0
MD5 5704933e813199ab01f71c5d1e7fdfbe
SHA1 f9304c3922eb4886376b5dcbb4e3e024f7e98dcf
SHA512 66dea926b5c6454bab4b4ecda1cd0af8c1c91353b852882a266c0d414db2f3d2017b59075291d9aac03e2fa3b89867c0f7f98030e58699f303760ad0ce05225e
SSDEEP 192:DIp4Il+DyPyfyAy3y5yCIxlpglARmlgPNP3aP9fPiyVxyMyByVV8y1ovOyHyJyjG:DIp4Il+D+4f0y5ZIxlpglARmlgPNfaFT
TLSH
T152227FF7C3D8862D885156F49B156F1FCE290A14532C3C27C9D8EF5BA3E6872E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e880f39272f21a372c7b2278df6186daf572f3c2d35dc2f36a033213b031007e
MD5 80638f2653b50f11eab8e5ca7ff1b8e3
SHA1 d2c44f4d6622b203bd7d06455af90606f506352c
SHA512 07bd90d83d5b863a09a39f1b0b20990a688a0b79397adbaa5a17bba8e84c387cc1649188f244b39c449162cef72cde1f6748b59d96b89b67146afa2b9648eeb7
SSDEEP 192:+RPcBzI7Q2v7+rAPRp2/XP9pHsb+WNn7A4ly2f62O3IurTVyIsnAUge:+RPmzIUCvXiTwM/2i2O3/1e
TLSH
T1A542A32FB9106A7B9DDBC329F9667B97E6F5102126942EC4E6FC892C10E79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1ff34fc65221c5c7df7931bdc494b7404ce8f8c1332b41935ddff62e40ce7eae
MD5 b5177d10220e6f32f2d7051ea62807df
SHA1 980d4e550fbbfe5089782e294b410a5c540317f8
SHA512 c15fd65096a60bd1160a0699de2ae2f7d571a70298bc0f0c46bbd4f362210deb6eb175f60b75f2191a0253952bd81ffd1a6e48f739e789dc13a0f5f22a406fdc
SSDEEP 192:+RPcBzI7QBv7+rRPRp5mfX5G9pHsb+WNy37ApHk+ly24T62O3IuJTVyIsnAUgE:+RPmzIURcXhTwL+t2422O3t1E
TLSH
T13652C52FA8106A7B9DDBC319F856BB57E2F5202126903EC4E7FD892C10E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 36b040ac2a9a0a90bb1c0437542543e4b1a05161b2c4e3caf5930ef385ec2114
MD5 22782a532c0f06d6ee116d47767e34cd
SHA1 19ae41e93bdcc31860584481bba51c0c04a46283
SHA512 dca10bdb682054cd9dbee61c83af981676fc5629e70fb335cb2ac597882b3fa75df4978ff21103c15e813b234f42a00aa555cb29b4e39279fe0da945941fa85e
SSDEEP 192:+RPcBzI7Qov7+rRPRp5mHX589pHsb+WNy37ApHk+ly24T62O3IuJTVyIsnAUgE:+RPmzIU0cXfTwL+t2422O3t1E
TLSH
T10952C66FB9106A7B9DDBC319F9567B57E2F5202126902EC4E7FD892C10E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 20767dbcb5953568879e43aed763c88489e48fd158911bfe93752fc0bab15074
MD5 22141fa166e64f195b479383558b5cee
SHA1 0790ab57ceac9ae4ef474af81665272e35f74e0e
SHA512 570bbff2fed64adff0d7cc13beb78156dd3140282907a385923e8f40d70fc21da8a9f25a47dee29045561149f388acdd973aebe8d8814c341122ac6c0f8450df
SSDEEP 192:+RPcBzIcQov7+rRPRp5mHX589pHsb+WNy37ApHk+ly24T62O3IuJTVyIsnAUgE:+RPmzIt0cXfTwL+t2422O3t1E
TLSH
T19F52C66FB9106A7B9DDBC319F9567B57E2F5202126902EC4E7FD892C10E7ACC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 8ae4e2e95e249722b8dd9e18794c1e7f097df2851c56d4ed0a8d00ba78d405bf
MD5 3f7b002b53d676aa59e651e616feb056
SHA1 366b9f55cac4ffbf1f85a8afcc1ec968d514cc3b
SHA512 73132d90d9657dfcac8de06102ef980a6dfe1815006af0bbc6b60deec16564c2a0abec302fea29169cd4ec76b62f9ac96062a28d36b0fe43fad433977add7803
SSDEEP 384:uEjEn7KxkXqKf/pUZNCgVLH2HfgslLtXODEL+ErU3DAHGqnSxHn:uIEn7KxkXqKf/pUZNCgVLH2Hfgs9JOwY
TLSH
T1FB52F927688D9A7F0FC8D55CDC577F4FACB5025B66A8086497FB5C0803A67CE110A2E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\b6dd2f06-d385-4440-8b91-5c1d2f74c671\index-dir\the-real-index
Size 72B
SHA256 9bc7299f3940a960f079393ee46f1a3bf03ff6b280fbeebe8c784f0ab434931a
MD5 dfb61d5ca6e0800cf2bd877154699be9
SHA1 7a3ddd68e091cf26a6c0b9f7bcd9508032635866
SHA512 6de57106ac1f623591f520baa059776941f663113d00e64881d50b88cec501a8b547ac21481a9228a28eec9ed567ad26ebfa92a1aa84bad4d686d761eff60d2c
TLSH
T1C7A002D0A151C803D5045EB024817350233C5864190DEB8154D850FA98A41544935110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5eb554.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\b6dd2f06-d385-4440-8b91-5c1d2f74c671\index-dir\the-real-index~RFe5eb554.TMP
Size 48B
SHA256 fb818682c9ceccb9b419696760bdea379462910db8bdcb701f15334d2c911f70
MD5 c58aebe7b4a766b8aa683ec2ad7006a2
SHA1 2d9bcf4c7cf6bf160512779a6cd05376a69e55de
SHA512 5de0a260b0fd7653328da6d5c313f06ad4f8f4701c4c0f6fe8f69aea7766bc71bc370637212d211c65e26097bf4fec5a18619c934310d4e067bc0d64598898d9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\index.txt
Size 135B
SHA256 7746b3c59a47e7386f60beec04a104f7163adcf91d8e51f67da091103f2d61a1
MD5 0fa226f67031dc6afe4bfe755b65b1aa
SHA1 8fc10242926bac147a5bb90d4645665fc2df944c
SHA512 97e54a92f7093c40e1df4e2070494ba280ee340db1a8823b10f35b9cefa1ccbd1cdd7534a8215c64bdd7d3bcd5da2b9265f0e89e7313909ede2fdc584fc8bc2a
TLSH
T1ACC02B3F800373005F1093D4302007478397C4810690C04CE4391C8C9B20B3DB1C3A41
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5eb583.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\116a2459d02c031f944714e6f3f3a77cb3eadb79\index.txt~RFe5eb583.TMP
Size 141B
SHA256 b7138a2d6e82146c19a4b7cd39ae5d27e37481b017667cc9f55080672da44b1a
MD5 6c3f887f212150f5e9152ac78bc2e25d
SHA1 bddcd2d9dc1df3f93ec159486e7302daf7ea50ba
SHA512 bebd8345501926b0a9b609d82ffc65f63d4a63406a9cec87a94e2af011f58402669d65aac0bfb7f484f830b70014a8f64402f0b66e050ca1a05c77f7b1807530
TLSH
T196C08C2F401362006F1041D43420068646A68C810E40C04CE02A3C8CAB30B3AB285A41
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 9KB
SHA256 eea7b81507429d7b8f8bdcf6df8c26eafdc15de27cfe20eec0567399a834ce97
MD5 2163e4559d1a5b98e7c5d6c28502fdfa
SHA1 ecb59d18de76ef5209308b0e85ae87a7b7236dec
SHA512 4df262bbed571b629935edbe43f166cbf3b8b0ebb990c78519d0ccae83c9d313a98515d06d50c33490ec2db940701c15d2c586e6fbd0acdf02d80af16c57f9ee
SSDEEP 192:9rcq09bV7jO0zqQdF4WodWGLYsOPfUp4+FqeA:W9bZ+WcwUp4+FjA
TLSH
T11912EACDBF6C941A4F732078B94AD4572C3FB0731F4BE883E59D0A68A4906879396F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 8KB
SHA256 b5a492dae373c17d7eca668590749a879789580cc1f582b708dac6faaaa0e575
MD5 ef99169e7c5954d4891dff8f41d02e0c
SHA1 f1b1d1e81b202718018047a0f29c2cb3a9d676a1
SHA512 c9c361df591382beba23a3f9066f514d7d27960fe9142a93aa7dcb2eaec8501bf6e384b3c7da390eda620e9e24072a64c0a141033b607a0da57b0c5236d74077
SSDEEP 192:PiPg40WIBA/17EubI32/9O2TeVU82BIK9ILUe897CN6vsuQ:cL0vBw5Eqr/9O2T0vgIGILUllCys
TLSH
T1E612C60147A1192BCD7723FB516389A733368104BF87A75E51B373789C213F3A599686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2512bff42fcbd85fa16508fc4e0cd3e7f1aa02b4b9066379712b66fb64ef42e1
MD5 d486b3e6e3c927b04134be540a2d7ca5
SHA1 53b9bdf1e16c8b0f6047d2cba391e923514580ae
SHA512 34ab85fbc3f36ab09ee0fc3a760ff2a43970db0625f830365f426778e6da166c9b893b1128b2a31b75d57433e723124997ffdb1e2df4195b4282ac207b3f642b
TLSH
T19AB0122E81861912D82191F4110C107561115E22805543C682E0D5CDC8431D01B20521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f5ceba807db7d949c82fc6fe0ba06a921c0a41e9e3e94368271abd8d180f93a6
MD5 551fedafbcff82ae7e48bd023119d474
SHA1 582e5f0febddd964cbe7b8d35569b91163dd89f0
SHA512 da86be60163fe93fe5ee16687c2c62bca159258b7113f8afbd87723f3f06f252411157a2fb3d19b62f5c866dc3fa6c016f5f57d12ff8cc3e5f2e92d0833c6f1b
TLSH
T12BB0222080800E33C30083B0A3C020EC33B32C080BAF8A8200A0A0E0E0022C32B03B08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 4af520c8f8bc55800f2a13378c8e0cdc55df3face9437aadf1e29bc78b040b17
MD5 524f4b941ccdbcc926665644f79434fa
SHA1 5435b8d4bb30d041774e9be864521e7b5630cf0e
SHA512 e4755c5ae92f7382b89547fa180ec19d98a5fe0634e49408276f9a8ac9b3a594ce06207625724ca0edf48950146ac7e62745555e847a092c8b6ff96cbcfab790
TLSH
T1BFA0026141E44811DD1082B071710669E6D988185792D78355A2C6C5A8DB9C5BE86561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e9a59.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5e9a59.TMP
Size 48B
SHA256 66961e5d7bbfa224e5bf92a49a281353ea27fc1deac96656eb53a3a92f745eeb
MD5 db016f358544a9be06c1785d8c35ee08
SHA1 8407e34fd0ad065ecc2eb12ea388c7d25d361d5b
SHA512 571f97824c6b551bcabdf9e8ca4fcfe26e989eebee20cd0b6d43911cd0faa0f328a09680f7eb43e380e4ae5ee48ae2a3ef8a3c562b7f3a772b303efd6e354883
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

.usage

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\.usage
Size 24B
SHA256 fac0a85e4f5907c8036b0052214b777ddbacea9420e5903526272dc76bd4c7b6
MD5 e1edf83f1dbe0a1640e5800ef2f44b90
SHA1 58e8f31a1282e84a05c6960d6ab461d6ccef42cc
SHA512 151b19bcb34d72c304d02f2830f577036c5d2156499cb998643a87a3010544e5a4c236f8458786ea4b3416aaa4fd1ea96fc3bfe1ab0c5baebeac29e5427ca417
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 874e439a4b7712a4a5cbd779dc4e2f3fe380d4e844124dd434f010555fa07d6b
MD5 81ad96918421ada7be6205ea00f06f15
SHA1 5d1730b019e138ee3f58190af2c9020dcde35fe4
SHA512 9fa7b4ca2c2ab914f518e6216a48c47e0db3019b1c588825b24ddfe2bede08b1533be2ae5ce4e5be4b092da831db040c87af7166fc446b220a502b6316edf1b4
SSDEEP 96:mC0d+Ar2aetJRxW2rgj0+f+U+/EfezeRDotok55VDTB6JGyvTNm6zjn+PEhiv4a:mC0Nr7OJRPrL9/EtDUDvN9Imgjn+shM
TLSH
T1E7A11832A47E9CB749B38545F5563B07CFA4716B6A21FF84E9DD2B0C14A70DC1382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1306054a7bd9c6a1a96d32141a890a44768d9d3d98d267786ae0d285bb59f4d7
MD5 7ddc48ada7ef014c978cd608d2e2aa34
SHA1 5706d1062feea00b07dbcfca88f06fbe0921463e
SHA512 1db5e696ea4e125f5654aa85557c1af5298046f6fbaf4956243f57ecd06f1119b54823a384e36818bbaadfb778034d898fc11e83d855ee306c0c066abb911f01
SSDEEP 3072:47MEgf1PpGP03XQ0H+GESr/MRbbXwxkWpBI:LR1xTXQ0trg9XeI
TLSH
T157D312F1E9F9BB73869CD51BF00F222EDBF58C9A913487E41D6E8D0E14958B902D2D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 d79ca94c93827fc4c1168d8513f3c9e657d392d514cfcf5df79cb5b30aea1ba1
MD5 6f5653d73a1e72e141f5fca32599b8d4
SHA1 bca1aebe67098acfcc134d6e84c3c6801a76ebd7
SHA512 0720feeecddfeca160b4f7e498ddf635d015233da7c62e15bb78092c53329e14be7405f8463485dccc25364bef3412644c26a0f402908e86fac22bbfd0e80f9c
SSDEEP 3072:92kMEgf1PpGP03XQ0H+GESr/MRbbXwxkWpBI:47R1xTXQ0trg9XeI
TLSH
T154D312F1F8FAAB62869DC81FB00A312A9EF59D9BD138C7E83D2E5D0D14954BD05D2C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 a85e0e21431429dc3193336777ce73b288f96bd81a01b21c46cf1477913f29bf
MD5 d1b79ab7373aa19130d06dba100c57f9
SHA1 1ccc14edb00260ab4223f0fec8698aded14b885d
SHA512 440086d1fe510424bb642dea3bde482455f102ee1475ea40218737534b8ac6f634786dc517762eb58d6533e37622ed96d72aa6002899309475048816cd4887eb
SSDEEP 3072:V7MEgf1PpGP03XQ0H+GESr/MRbbXwxkWpBI:CR1xTXQ0trg9XeI
TLSH
T1BBD312F1E9F9BB73869CD51BF00F222EDBF58C9A913487E41D6E8D0E14954B902D2D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 278f28dc99cf9ea68f3e6ad72079d42c789da5ae478d113c9731821c62f29a40
MD5 697a42adeeef03dc191133f80ccf7392
SHA1 5372f68f2bc74ff00f7f6a7986e675e590ed6e64
SHA512 d0fb08f867e5981ab9d426cd334137a3280ec7c3d1fdf27f02d226c89764114e0380167838ff2a32e64b1e4d89e94831dbbc8f0b65a162091627dc2118f120a9
SSDEEP 3072:V2kMEgf1PpGP03XQ0H+GESr/MRbbXwxkWpBI:g7R1xTXQ0trg9XeI
TLSH
T1F8D312F1F8FAAB62869DC81FB00A312A9EF59D9BD138C7E83D2E9D0D14954BD05D2C41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4380_2034097265\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

sonoyuncuclient.exe

Path C:\Users\Admin\AppData\Roaming\.sonoyuncu\sonoyuncuclient.exe
Size 13.4MB
SHA256 a9106e8cad93054ba781e6f4ce24ad249faa88543f588cb91b7619412b83ef36
MD5 ca26ec392453aa3930cc0adf63ad88c2
SHA1 2f4811dac084029df0f98f7891b7f19893cebd75
SHA512 339d3ab5bd6bf389be6a96d32491423b5530d64c756ce8d69712dad7b330225e92d6443c699805811fa8d7d673dc810218e3493c116303eeccfa750802c457cd
SSDEEP 196608:F/zMDnTh+KmZXb/m+u3EzaSx8h1SH+ZDcloII/UIKZBd94u0IkPZwHIONaZel:F/55XjUEzHeh1U+bIbZJnjkx3/ZQ
TLSH
T18AE633B97D613492CC5CBAF50AC63ACA5DFCAE255EC8C148FD5A3069495D808B27CF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SonOyuncu Client.lnk

Path C:\Users\Admin\Desktop\SonOyuncu Client.lnk
Size 998B
SHA256 fa2f51c7269cbd7ffb8a43fbb760add9141325ff6c8df75725e99515428751a7
MD5 671f519a5a0c9847f9503123d1ff973b
SHA1 67ef47d6a409f92ca56487dbc1410af3d11be3c1
SHA512 52f6291069009c28944793a2e83e6c985e395b6b37efd2d7436a56621f0769e68e39c7e97981e0705021f110025203233d531aaab91b1476d734383f901dbcc1
TLSH
T13B11121159E20F6AE3F7A37A05B7A160CB3EFC436627F108C530620D1954E13AE1433B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-4-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/4868-0-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/4868-7-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/4868-3-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/4868-2-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/4868-1-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5140-1030-0x000001B607A00000-0x000001B607BE3000-memory.dmp

Download

memory/5140-888-0x000001B6042F0000-0x000001B604310000-memory.dmp

Download

memory/5140-867-0x000001B6001E0000-0x000001B6002E0000-memory.dmp

Download

memory/5140-882-0x000001B601E90000-0x000001B601F90000-memory.dmp

Download

memory/5140-880-0x000001B601BD0000-0x000001B601BF0000-memory.dmp

Download

memory/5140-913-0x000001B6042D0000-0x000001B6042F0000-memory.dmp

Download

memory/5460-48-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-47-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-41-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-40-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-39-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-38-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-37-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-36-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-35-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-34-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-43-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-33-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-32-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-44-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-31-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-45-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-46-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-682-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-545-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-42-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-54-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-49-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-50-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-13-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-12-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-11-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-51-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-9-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-10-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-8-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-52-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-90-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-53-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-59-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-58-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-57-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-56-0x0000000140000000-0x0000000142037000-memory.dmp

Download

memory/5460-55-0x0000000140000000-0x0000000142037000-memory.dmp

Download